Privacy Policy

1. Introduction

Ninth Wave Analytics LLC ("Company," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our 605b.ai website and application (the "Service").

PLEASE READ THIS PRIVACY POLICY CAREFULLY. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

We reserve the right to make changes to this Privacy Policy at any time. We will notify you of any changes by updating the "Effective Date" at the top of this Privacy Policy. Your continued use of the Service after any changes constitutes acceptance of those changes.

2. Information We Collect

2.1 Information You Provide Directly

We may collect the following information that you voluntarily provide:

• Account Information: Name, email address, and password when you create an account
• Profile Information: Information you provide during onboarding, including your situation, goals, and timeline preferences
• Credit Report Data: Information contained in credit reports you upload for analysis, which may include personally identifiable information, account details, payment history, and other financial information
• Dispute Information: Details about disputes you track, including creditor names, account information, dispute types, and correspondence
• Communications: Information you provide when you contact us for support or feedback

2.2 Information Collected Automatically

When you access the Service, we may automatically collect:

• Device Information: Device type, operating system, browser type, and unique device identifiers
• Log Data: IP address, access times, pages viewed, and referring URL
• Usage Data: Features used, actions taken, and time spent on the Service
• Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain your session and preferences

2.3 Sensitive Information

Important: Credit reports may contain sensitive personal information including Social Security numbers, dates of birth, addresses, and detailed financial information. We process this information solely to provide the Service and implement strong security measures to protect it. You should only upload credit reports if you are comfortable with our handling of this data as described in this Privacy Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To operate, maintain, and improve the Service, including analyzing credit reports, generating dispute letters, and tracking disputes
• Account Management: To create and manage your account, authenticate your identity, and provide customer support
• Communications: To send you service-related notifications, deadline reminders, and respond to your inquiries
• AI Processing: To process your credit reports and provide AI-powered analysis and recommendations
• Security: To detect, prevent, and address technical issues, fraud, and security threats
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Improvement: To analyze usage patterns and improve the Service

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Clerk: Authentication and user management
• Anthropic: AI processing for credit report analysis (credit report content is processed but not stored by Anthropic)
• Upstash: Database services for storing your disputes, settings, and audit logs
• Resend: Email delivery for notifications and reminders
• Vercel: Website hosting and infrastructure

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.4 With Your Consent

We may share your information with third parties when you have given us your consent to do so.

5. Data Storage and Security

5.1 Data Storage

Your data is stored on secure servers provided by our service providers. We use industry-standard encryption for data in transit (TLS/SSL) and at rest.

5.2 Credit Report Processing — NO PDF STORAGE

Important Privacy Protection: We do not store your uploaded credit report PDFs as retrievable files. They are processed for analysis and not retained as documents; only the analysis results you choose to save are stored to your account.

When you upload a credit report for analysis:

• PDF files are not retained — We do not store your uploaded credit report PDFs as retrievable files
• Text is extracted temporarily — Report content is extracted, sent to our AI for analysis, then not retained as a document
• Only findings are saved — We store only the analysis results (flagged items, issues found) you choose to save in your account
• AI provider does not retain data — Our AI provider (Anthropic) processes your data in real-time and does not store it after the request completes
• You control your data — You can delete your flagged items and analysis results at any time

5.3 Security Measures

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Secure authentication through our identity provider
• Regular security assessments
• Access controls limiting employee access to personal data

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Financial Data Access via Third-Party Integrations

With your explicit authorization, we may access financial account information through secure third-party data aggregation services. This section describes what data we access, how we use it, and how we protect it.

6.1 Data We May Access

When you connect a financial account, we may receive read-only access to:

• Transaction history (including merchant names, dates, amounts, and transaction categories)
• Account type and status metadata
• Available and current balances, where applicable
• Account identifiers necessary to maintain the connection

6.2 How We Use This Data

We use financial data solely to provide you with analytics, insights, and tools related to your personal financial management within our platform. This data helps you understand your financial activity in the context of the services we provide.

6.3 What We Do Not Do

Important: We do not initiate payments, transfer funds, or perform any form of money movement through these integrations. We do not use this data for credit underwriting, lending decisions, or account ownership verification. Access is strictly read-only.

6.4 Data Sharing and Retention

We do not sell your financial data. We do not share your financial data with third parties except as necessary to maintain the integration or as required by law. We retain financial data only for as long as reasonably necessary to provide our services to you or as required for legal compliance. You may revoke access or request deletion of this data at any time.

6.5 Data Storage

All financial data accessed through these integrations is stored exclusively in the United States using industry-standard encryption and security practices.

6.6 Your Consent

Financial data is accessed only after you provide explicit consent and complete the authorization process through our third-party data provider. You may disconnect your accounts at any time through your account settings.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. We may also retain certain information as required by law or for legitimate business purposes, such as:

• Audit logs are retained for potential litigation support
• Account information is retained until you request deletion
• Aggregated, anonymized data may be retained indefinitely for analytics

You may request deletion of your account and associated data at any time by contacting us.

8. Your Rights and Choices

8.1 Access and Portability

You may access your personal information through your account dashboard. You may export your dispute history and audit log at any time.

8.2 Correction

You may update or correct your account information at any time through your account settings.

8.3 Deletion

You may request deletion of your account and personal information by contacting us. We will delete or anonymize your information within 30 days, except where we are required to retain it by law.

8.4 Email Communications

You may opt out of non-essential email communications through your account settings. You cannot opt out of transactional emails related to your account.

8.5 Cookies

Most web browsers are set to accept cookies by default. You can usually modify your browser settings to remove or reject cookies. Note that removing or rejecting cookies may affect the availability and functionality of the Service.

9. State-Specific Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out: We do not sell personal information, so this right does not apply
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, please contact us using the information provided below.

9.2 Other State Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, or other states with comprehensive privacy laws, you may have similar rights. Please contact us to exercise your rights under applicable state law.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country. By using the Service, you consent to the transfer of your information to the United States and other countries.

12. Third-Party Links

The Service may contain links to third-party websites (such as AnnualCreditReport.com, IdentityTheft.gov, and credit bureau websites). We are not responsible for the privacy practices of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Do Not Track

Some browsers have a "Do Not Track" feature that signals to websites that you do not want to have your online activity tracked. The Service does not currently respond to "Do Not Track" signals.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us at:

We will respond to your request within 30 days (or sooner if required by applicable law).